REMARKS 



The Examiner has rejected Claims 1, 2, 5, 11, 15, 16, 19, 25, 29, 30, 33, 39 and 
45-49 under 35 U.S.C. 103(a) as being unpatentable over Welch, Jr. et al. (U.S. Patent 
No. 5,862,335), in view of Meadway et al. (U.S. Patent No. 6,675,205). Applicant 
respectfully disagrees with such rejection. 

With respect to the independent claims, the Examiner has relied on Col. 4, lines 
1 8-25 from Meadway (excerpted below) to make a prior art showing of applicant's 
claimed "performing an action associated with a suspicious pattern of activity when the 
suspicious pattern of activity is detected in the peer-to-peer network" (see this or similar, 
but not necessarily identical language in the independent claims). 

"...the update servers store the digital signature of the agent 
program and also store the remote web hosts' last local index, 
which are utilized during the updating of the remote agent program 
and during updating the local index , as will also be discussed in 
more detail below. Each of the update servers 222 applies all 
index change transactions through a firewall/router 224 to the 
master index server 218 which, in turn, updates the central search 
index and then distributes those changes to the various index 
servers sets 216." (Col. 4, lines 17-25 - emphasis added). 

As shown above, the excerpt from Meadway relied on by the Examiner only 
relates to updating an index , and specifically teaches that "the remote web hosts' last 
local index is utilized during the updating of the remote agent program and during 
updating the local index " (emphasis added). Clearly, updating an index does not even 
suggest "a suspicious pattern of activity," let alone "performing an action associated with 
a suspicious pattern of activity when the suspicious pattern of activity is detected in the 
peer-to-peer network " (emphasis added), as applicant claims. 

Fiarther, with respect to the independent claims, the Examiner has relied on Col. 
2, lines 35-40 (excerpted below) and Col. 4, lines 18-25 (excerpted above) from the 
Meadway reference to make a prior art showing of applicant's claimed technique 
"wherein the suspicious pattern of activity is defined in terms of a configuration of shared 
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data on a peer, the configuration establishing a baseline of authorized shares and 
permissions in association with the shared data" (see this or similar, but not necessarily 
identical language in the independent claims). 

"To allow operation of the invented file sharing system without 
compromising the firewall, the agent program is configured to 
behave as follows. The agent reports to the central server the 
identities of files on the computer that will be provided if 
requested by others ." (Col. 2, lines 35-40 - emphasis added) 

As noted above, Col. 4, lines 18-25 from Meadway, as relied on by the Examiner, 
only relate to updating an index . Additionally, Col. 2, lines 35-40 from Meadway, as 
also relied on by the Examiner, simply discloses that an "agent reports to the central 
server the identities of files on the computer that will be provided if requested by others " 
(emphasis added). Clearly, updating an index and reporting the identities of files that 
will be provided if requested by others, as in Meadway, does not specifically teach a 
"suspicious pattern of activity," and especially does not teach that " the suspicious pattern 
of activity is defined in terms ofa configuralion of shared data on a peer, the 
configuration establishing a baseline of authorized shares and permissions in association 
with the shared data" (emphasis added), as claimed. 

To establish a prima facie case of obviousness, three basic criteria must be met. 
First, there must be some suggestion or motivation, either in the references themselves or 
in the knowledge generally available to one of ordinary skill in the art, to modify the 
reference or to combine reference teachings. Second, there must be a reasonable 
expectation of success. Finally, the prior art reference (or references when combined) 
must teach or suggest all the claim limitations. The teaching or suggestion to make the 
claimed combination and the reasonable expectation of success must both be found in the 
prior art and not based on applicant's disclosure. In re Vaeck,9Al F.2d 488, 20 USPQ2d 
1438 (Fed.Cir.1991). 

Applicant respectfully asserts that at least the third element of the prima facie 
case of obviousness has not been met, since the prior art excerpts, as relied upon by the 
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Examiner, fail to teach or suggest all of the claim limitations, as noted above. 
Nevertheless, despite such paramount deficiencies and in the spirit of expediting the 

prosecution of the present application, applicant has amended the independent claims to 
further distinguish applicant's claim language from the prior art reference excerpts relied 
on by the Examiner reference, as follows: 

"the suspicious pattern of activity defined by a set of rules for detecting at least 
one of Trojan horse code, viruses, a user browsing data across peers, unwanted user 
activity, and malicious code attempting to contact a home location" (see this or similar, 
but not necessarily identical language in the independent claims). 

Applicant again respectfully asserts that Meadway's mere disclosure of updating 
an index does not even suggest a " suspicious pattern of activity" where "the suspicious 
pattern of activity [is] defined by a set of rules for detecting at least one of Trojan horse 
code, viruses, a user browsing data across peers, unwanted user activity, and malicious 
code attempting to contact a home location" (emphasis added), as claimed. 

Thus, since at least the third element of the prima facie case of obviousness has 
not been met, especially in view of the amendment made hereinabove to the independent 
claims, a notice of allowance or a proper prior art showing of all of applicant's claim 
limitations, in combination with the remaining claim elements, is respectfiilly requested. 

Still yet, applicant brings to the Examiner's attention the subject matter of new 
Claims 50-52 below, which are added for fiill consideration: 

"wherein the suspicious pattern of activity includes a number of failed 
attempts by a computer in accessing an internal peer that exceeds a predetermined 
nvimber" (see Claim 50); 
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"wherein the suspicious pattern of activity includes more than a pre- 
defined number of internal computers requesting resolution of a single external 
address within a preset period of time" (see Claim 51); and 

"wherein the share configuration loop is executed in parallel with a 
network traffic loop that detects incoming or outgoing network traffic from a 
computer as exhibiting an activity pattern defined as suspicious by a rule" (see 
Claim 52). 

In the Notice of Non-Responsive Amendment dated 02/22/2010, the Examiner 
has argued that "[a]pplicant has not explained how these [new] claims are patentable over 
the prior art of record as required" and has referred to 37 CFR 1.111. 

In response, applicant respectfully notes that, with respect to newly added Claims 
50 and 5 1 , Meadway merely discloses updating an index and reporting the identities of 
files that will be provided if requested by others, which does not specifically teach a 
"suspicious pattern of activity," much less applicant's claimed technique "wherein the 
suspicious pattern of activity includes a number of failed attempts by a computer in 
accessing an internal peer that exceeds a predetermined number " (see Claim 50 - 
emphasis added) or applicant's claimed technique "wherein the suspicious pattern of 
activity includes more than a pre-defined number of intemal computers requesting 
resolution of a single external address within a preset period of time " (see Claim 5 1 - 
emphasis added), as specifically claimed by applicant. 

Additionally, with respect to newly added Claim 52, applicant notes that 
Meadway merely discloses that "indexing and content reporting fiinctions necessary for 
the service are performed by an individual copy of an agent program downloaded and 

installed by each peer system user" and that "[t]he indexing process on each system may 
be initiated manually or on a scheduled basis, with updates transmitted whenever the user 
connects to the central service" (Col. 1, line 66 - Col. 2, line 8). However, merely 
performing indexing and content reporting fiinctions via an agent program, as in 
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Meadway, fails to teach applicant's claimed technique "wherein the share configuration 
loop is executed in parallel with a network traffic loop that detects incoming or outgoing 

network traffic from a computer as exhibiting an activity pattern defined as suspicious by 
a rule " (emphasis added), as specifically claimed by applicant. 

Again, since at least the third element of the prima facie case of obviousness has 
not been met, a notice of allowance or a proper prior art showing of ^ of apphcant's 
claim limitations, in combination with the remaining claim elements, is respectfully 
requested. 

To this end, all of the independent claims are deemed allowable. Moreover, the 
remaining dependent claims are further deemed allowable, in view of their dependence 
on such independent claims. 

In the event a telephone conversation would expedite the prosecution of this 
application, the Examiner may reach the undersigned at (408) 971-2573. The 
Commissioner is authorized to charge any additional fees or credit any overpayment to 
Deposit Account No. 50-1351 (Order No. NAI1P344). 

Respectfully submitted, 
Zilka-Kotab, PC 

/KEVINZILKA/ 

Kevin J. Zilka 
Registration No. 4 1 ,429 



P.O.Box 721120 
San Jose, CA 95172-1120 
408-971-2573 



-14- 



